Skip to content

Bump postcss-selector-parser, stylelint and stylelint-config-standard - #992

Merged
erwindon merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-af2049d064
Oct 12, 2026
Merged

Bump postcss-selector-parser, stylelint and stylelint-config-standard#992
erwindon merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-af2049d064

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependencies postcss-selector-parser, stylelint and stylelint-config-standard. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • See full diff in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates stylelint from 14.16.1 to 17.16.0

Release notes

Sourced from stylelint's releases.

17.16.0

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

  • Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

  • Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
  • Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
  • Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
  • Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
  • Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1

It fixes 4 bugs.

  • Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
  • Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
  • Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0

It fixes 3 bugs, including a false negative one.

  • Fixed: performance of getting module paths (#9354) (@​jeddy3).
  • Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
  • Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0

It fixes 3 bugs, including a false negative one.

  • Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
  • Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
  • Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0

It fixes 3 bugs, including a false negative one.

  • Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
  • Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

17.11.1

It fixes 2 bugs.

  • Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#9282) (@​tuhtah).
  • Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#9273) (@​pamelalozano16).

... (truncated)

Changelog

Sourced from stylelint's changelog.

17.16.0 - 2026-10-01

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

  • Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0 - 2026-09-04

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

  • Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
  • Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
  • Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
  • Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
  • Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1 - 2026-07-20

It fixes 4 bugs.

  • Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
  • Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
  • Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0 - 2026-06-25

It fixes 3 bugs, including a false negative one.

  • Fixed: performance of getting module paths (#9354) (@​jeddy3).
  • Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
  • Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0 - 2026-06-06

It fixes 3 bugs, including a false negative one.

  • Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
  • Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
  • Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0 - 2026-05-20

It fixes 3 bugs, including a false negative one.

  • Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
  • Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

... (truncated)

Commits
  • bc06c7c Release 17.16.0 (#9551)
  • f4fb76f Set target-branch to v18 in Dependabot config (#9488)
  • 2019478 Fix property-layout-mappings and unit-layout-mappings false negatives for...
  • e875710 Fix value-keyword-layout-mappings false positives for caption-side (#9483)
  • 0547bff Release 17.15.0 (#9484)
  • ac19a3c Fix custom-property-no-missing-var-function false positives for anchor posi...
  • 23947ae Bump @​humanfs/node from 0.16.6 to 0.16.8 (#9480)
  • 53c74f7 Bump fast-uri from 3.1.5 to 3.1.7 (#9481)
  • 26856e6 Bump the jest group across 1 directory with 2 updates (#9476)
  • b90ecd8 Bump browserslist from 4.28.4 to 4.28.8 (#9479)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates stylelint-config-standard from 29.0.0 to 40.0.0

Release notes

Sourced from stylelint-config-standard's releases.

40.0.0

  • Removed: stylelint less than 17.0.0 from peer dependencies.
  • Removed: support for Node.js less than 20.19.0.
  • Changed: updated to stylelint-config-recommended@18.0.0.
  • Changed: module type to ESM.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.

39.0.0

38.0.0

  • Removed: stylelint less than 16.18.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@16.0.0.
  • Added: color-function-alias-notation: "without-alpha" rule.
  • Added: container-name-pattern (kebab-case with optional -- prefix) rule.
  • Added: layer-name-pattern (kebab-case) rule.

37.0.0

36.0.1

  • Fixed: missing funding field in package.json.

36.0.0

  • Removed: stylelint less than 16.1.0 from peer dependencies.
  • Added: lightness-notation: "percentage" rule.

35.0.0

34.0.0

33.0.0

  • Removed: stylelint less than 15.5.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@12.0.0.
  • Changed: restored declaration-block-single-line-max-declarations removed on 30.0.0.

32.0.0

  • Removed: stylelint less than 15.4.0 from peer dependencies.
  • Added: media-feature-range-notation: "context" rule

... (truncated)

Changelog

Sourced from stylelint-config-standard's changelog.

40.0.0

  • Removed: stylelint less than 17.0.0 from peer dependencies.
  • Removed: support for Node.js less than 20.19.0.
  • Changed: updated to stylelint-config-recommended@18.0.0.
  • Changed: module type to ESM.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.

39.0.0

38.0.0

  • Removed: stylelint less than 16.18.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@16.0.0.
  • Added: color-function-alias-notation: "without-alpha" rule.
  • Added: container-name-pattern (kebab-case with optional -- prefix) rule.
  • Added: layer-name-pattern (kebab-case) rule.

37.0.0

36.0.1

  • Fixed: missing funding field in package.json.

36.0.0

  • Removed: stylelint less than 16.1.0 from peer dependencies.
  • Added: lightness-notation: "percentage" rule.

35.0.0

34.0.0

... (truncated)

Commits
  • fbbe7b8 Release 40.0.0 (#386)
  • e6368f9 Prepare 40.0.0 (#381)
  • 481e21c Bump the dev-deps group with 3 updates (#382)
  • 696689d Bump stylelint/.github/.github/workflows/call-release-pr.yml from 0.3.1 to 0....
  • 5d46c0f Bump stylelint/.github/.github/workflows/call-lint.yml from 0.3.1 to 0.5.0 (#...
  • f888c90 Bump stylelint/.github/.github/workflows/call-test.yml from 0.3.1 to 0.5.0 (#...
  • 066dda1 Fix vulnerable dependencies via npm audit fix (#378)
  • b6e6aec Bump js-yaml from 4.1.0 to 4.1.1 (#379)
  • 63bb8dd Bump mdast-util-to-hast from 13.1.0 to 13.2.1 (#380)
  • 0cc790a Bump the dev-deps group with 2 updates (#377)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint-config-standard since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 6, 2026
@erwindon erwindon self-assigned this Oct 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-af2049d064 branch from b18790f to c9cfb4b Compare October 12, 2026 00:54
@erwindon

erwindon commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

@dependabot recreate

@dependabot
Bump postcss-selector-parser, stylelint and stylelint-config-standard
ff775e5 
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.6 and updates ancestor dependencies [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser), [stylelint](https://github.com/stylelint/stylelint) and [stylelint-config-standard](https://github.com/stylelint/stylelint-config-standard). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 6.1.4 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.6)

Updates `stylelint` from 14.16.1 to 17.16.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@14.16.1...17.16.0)

Updates `stylelint-config-standard` from 29.0.0 to 40.0.0
- [Release notes](https://github.com/stylelint/stylelint-config-standard/releases)
- [Changelog](https://github.com/stylelint/stylelint-config-standard/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint-config-standard@29.0.0...40.0.0)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: stylelint
  dependency-version: 17.16.0
  dependency-type: direct:development
- dependency-name: stylelint-config-standard
  dependency-version: 40.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-af2049d064 branch from c9cfb4b to ff775e5 Compare October 12, 2026 01:04
@erwindon erwindon closed this Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-af2049d064 branch October 12, 2026 01:06
@erwindon
erwindon restored the dependabot/npm_and_yarn/multi-af2049d064 branch October 12, 2026 01:06
@erwindon erwindon reopened this Oct 12, 2026
@erwindon
erwindon merged commit e07e83f into master Oct 12, 2026
12 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-af2049d064 branch October 12, 2026 01:07
@sonarqubecloud

sonarqubecloud Bot commented Oct 12, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@erwindon erwindon

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@erwindon